The Regulated Fund

Regulation (EU) 2024/1689, the European Union's Artificial Intelligence Act, entered into force on 1 August 2024 with a phased implementation timeline. The prohibitions under Article 5 have applied since 2 February 2025; general-purpose AI (GPAI) obligations applied from 2 August 2025; the high-risk regime for systems listed in Annex III applies in full from 2 August 2026; and high-risk obligations for systems embedded in regulated products under Annex I apply from 2 August 2027.¹ By the August 2026 milestone, any AI system placed on the EU market or used to inform decisions that have legal or similarly significant effects on persons inside the Union must meet a comprehensive set of risk management, documentation, transparency, human oversight and post-market monitoring obligations.

For private capital, three elements of the Act bear directly on investment operations. First, the prohibition list under Article 5 captures certain forms of social scoring and predictive profiling that touch on diligence on individual founders, executives or beneficial owners. Second, Annex III(5)(b) of the Regulation expressly lists AI systems used to evaluate the creditworthiness or establish the credit score of natural persons as high-risk, with a carve-out for systems used to detect financial fraud. Annex III(1) covers biometric systems and Annex III(4) covers employment and worker-management uses. These categories have direct implications for private credit, venture debt and direct lending strategies, as well as for founder and executive screening where used in hiring contexts.¹

Third, the general purpose AI (GPAI) obligations apply not only to model providers but to deployers that integrate foundation models into substantive workflows. A fund that uses a frontier model to draft IC memos, score deals, or generate LP reporting commentary is a deployer under the Act and inherits documentation, transparency and human oversight duties accordingly.

Penalties are graduated and significant. Under Article 99(3), breaches of the prohibited-use list carry fines of up to EUR 35 million or 7% of worldwide annual turnover, whichever is higher. Under Article 99(4), breaches of obligations applicable to high-risk system providers and deployers carry fines of up to EUR 15 million or 3% of turnover. Under Article 99(5), supplying incorrect, incomplete or misleading information to authorities carries fines of up to EUR 7.5 million or 1% of turnover. The European Commission may separately fine GPAI model providers up to EUR 15 million or 3% of turnover under Article 101. For SMEs and start-ups, the lower of the two amounts applies under Article 99(6). Critically, the Act has extraterritorial reach: any fund that markets vehicles into the EU, holds EU-resident LPs, or makes decisions that affect persons inside the Union is in scope, regardless of where the GP is domiciled.

Regulatory cascades from Brussels are not a new phenomenon. GDPR established a global baseline for data protection that California, Brazil, India and Singapore subsequently mirrored. The AI Act is following the same trajectory, but on a compressed timeline. Within twelve months of the Act's entry into force, every major financial regulator outside the EU had either issued formal guidance, opened a consultation, or signalled an intent to align with its risk-based taxonomy.

The United Kingdom's Financial Conduct Authority, while resisting a horizontal AI law in favour of a principles-based approach, has explicitly referenced the AI Act's high-risk categories in its supervisory statements and in Discussion Paper DP5/22 on AI and machine learning in financial services.³ Funds regulated under the FCA's senior managers regime are expected to evidence equivalent governance, model risk management and human oversight even in the absence of statutory text.

In the United States, the Securities and Exchange Commission's 2023 proposed rule on conflicts of interest arising from the use of predictive data analytics (Release No. 34-97990) covered any technology that "optimises for, predicts, guides, forecasts, or directs investment-related behaviours." The rule was formally withdrawn in June 2025.⁴ The substantive concerns it sought to address have not gone away. The SEC continues to apply the Investment Advisers Act of 1940 fiduciary duty and the Marketing Rule (Rule 206(4)-1) to AI-assisted advice, performance claims and conflicts disclosure, and Division of Investment Management guidance on AI use in investment advisory activity remains expected. Concurrent state-level legislation, notably the Colorado Artificial Intelligence Act and New York City Local Law 144, creates additional compliance overlays.

In Asia, the Monetary Authority of Singapore's Veritas Initiative and FEAT principles (fairness, ethics, accountability, transparency) provide a mature framework that pre-dates the EU Act but has been progressively aligned with it.⁵ The Hong Kong Securities and Futures Commission issued a circular in November 2024 setting expectations for the use of generative AI language models in licensed activities, including investment management.⁶ The Australian Securities and Investments Commission's Report 798, "Beware the gap: Governance arrangements in the face of AI innovation" (October 2024), sets out supervisory expectations on AI governance, model risk and human oversight for licensed financial firms.⁷

The cumulative effect is a global floor. A fund operating in any major capital market in 2027 will face substantively similar obligations regardless of where it is domiciled. The differences are at the margins: data residency in APAC, sanctions and CFIUS overlay in the United States, ESG and disclosure intensity in the EU. The core requirements (model inventory, decision provenance, human oversight, post-market monitoring) are converging.

The AI Act does not arrive in isolation. It sits alongside a revised Alternative Investment Fund Managers Directive (AIFMD II), an updated Sustainable Finance Disclosure Regulation (SFDR), and ESMA's Union Strategic Supervisory Priorities and 2025 Annual Work Programme.² For European GPs and for non-EU GPs marketing under the National Private Placement Regimes, the obligations stack.

AIFMD II extends delegation rules, tightens liquidity management for loan-originating funds, and introduces enhanced reporting on portfolio composition and risk concentration. ESMA has indicated that look-through reporting will require GPs to evidence how portfolio-level data is collected, validated and aggregated, an exercise that becomes materially more onerous when AI is in the loop.

SFDR's Level 2 technical standards require Principal Adverse Impact disclosures that are difficult to produce reliably without a structured, queryable record of underlying investment data. Where AI assists in ESG scoring or sustainability classification, the AI Act layers documentation duties on top of the disclosure regime itself.

The practical consequence is that European-active funds face simultaneous obligations under at least four overlapping regimes: the AI Act, AIFMD II, SFDR, and MiFID II for any in-scope distribution activity. A fund's ability to evidence compliance turns on whether decision-making, portfolio data and AI usage are captured in a single, auditable layer or scattered across a fragmented stack.

The United States has no federal equivalent of the AI Act. What it has instead is a patchwork: SEC rulemaking on predictive data analytics, the Marketing Rule's prohibitions on misleading performance claims, Colorado's AI Act covering high-risk consumer-facing systems, New York City's Local Law 144 on automated employment decision tools, and an evolving Treasury/OFAC sanctions regime that increasingly expects algorithmic screening of counterparties.⁴

Layered on top, CFIUS reviews of cross-border investments have expanded in scope and frequency. Any fund with non-US LPs or non-US co-investors must increasingly evidence the provenance of decision-making on US-domiciled assets, particularly in technology, biotech and critical infrastructure sectors.

The fragmentation is itself the compliance challenge. A US fund operating across multiple states with European LPs and Middle Eastern co-investors must reconcile SEC, EU AI Act, GDPR, OFAC, CFIUS and state-level obligations into a coherent operating model. Doing so without a unified record of how investment decisions were made, by whom, against which data, and with what AI assistance, is no longer a serious option.

Asia-Pacific regulators have generally moved earlier than the United States on AI in financial services, although with lighter statutory force than the EU. Singapore's MAS published the FEAT principles in 2018 and operationalised them through the Veritas toolkit, which is now in its third iteration and includes specific guidance on generative AI in investment management.⁵

Hong Kong's SFC issued a circular in November 2024 covering the use of generative AI language models by licensed corporations, including expectations on testing, validation, human oversight and disclosure to clients.⁶ Japan's FSA has published AI principles aligned broadly with the OECD framework. Australia's ASIC has set out supervisory expectations on AI governance, model risk and human oversight in Report 798 (October 2024), reinforced by ongoing market integrity rules covering algorithmic decisioning and automated advice.⁷

In the Gulf, ADGM and the DFSA have issued AI ethics and governance frameworks designed to align with international AI governance norms and to ease cross-border investor due diligence. These frameworks do not confer EU adequacy and do not substitute for direct compliance with Regulation (EU) 2024/1689, but they reduce friction for funds raising from sovereign wealth pools and family offices in the region where alignment with the Brussels framework is increasingly expected.

Data residency adds an additional layer. China's PIPL, India's DPDP Act, and Indonesia's PDP law all impose localisation requirements that affect how diligence data on local portfolio companies is processed, particularly when AI systems hosted outside the jurisdiction are involved.

The convergent regulatory environment translates into a consistent set of operational requirements across jurisdictions. A general partner that meets these requirements once meets them substantively everywhere.

Model inventory. A maintained register of every AI system, foundation model and analytical tool used in the investment workflow, classified by risk tier, with owners, version history and validation status. Required under the EU AI Act, expected under FCA principles, and increasingly requested in LP DDQs.⁸

Decision provenance. A timestamped, attributable record of how each investment decision was reached: data considered, alternatives evaluated, AI outputs used, human overrides applied, and rationale recorded. This is the single most consequential operational requirement, and the one most difficult to retrofit onto a fragmented stack.

Human-in-the-loop documentation. Evidence that material decisions were reviewed, contested or approved by a competent natural person, with the basis for that review preserved. Article 14 of the EU AI Act is explicit on this point.

Vendor diligence on AI providers. The Act treats deployers as accountable for the model provider's compliance posture. Funds must evidence that the foundation models and AI services they use are themselves compliant, or that they have implemented controls compensating for any gaps.

LP-facing AI disclosure. ILPA's 2025 update to the Diligence Questionnaire introduces a dedicated AI Governance module covering model inventory, risk classification, human oversight, training data sources and disclosure to portfolio companies.⁸ Reuben AI modelling, based on ILPA DDQ v2.0 adoption tracking, projects that roughly nine in ten institutional questionnaires will include this module by the 2026 fundraising cycle.

Board-level AI governance. The Act and parallel guidance from the FCA, MAS and SFC all anticipate that AI governance reports to the board or its equivalent. For private capital firms, this typically means a dedicated AI risk committee or an extended remit for the existing risk committee.

The headline penalty under the EU AI Act, EUR 35 million or 7% of worldwide turnover, is the most visible cost of non-compliance. It is not the most significant. For a private capital firm, fines are a tail risk. The base-rate costs are fundraising friction, deal blockage and reputational drag.

Fundraising friction is the most immediate effect. An LP that finds an unanswered AI governance module in a DDQ is unlikely to drop the fund from consideration, but the response cycle slows materially. Reuben AI analysis, drawing on Deloitte and PwC commentary on LP behaviour through 2025, indicates that funds with mature AI governance answered DDQs measurably faster than peers and progressed to second-round meetings at a higher rate.⁹

Deal blockage emerges where AI-assisted diligence touches a portfolio company in a regulated sector. Lenders, exchanges and acquirers increasingly require evidence that diligence outputs were generated under compliant conditions. A fund that cannot evidence the provenance of its analytical work may find itself unable to participate in syndicates or unable to exit through certain routes.

Reputational exposure is the longest-tailed cost. Public enforcement actions under the AI Act will be rare in the first two years but visible when they occur. For an asset class that depends on reputation for deal access, even a procedural finding can be disproportionately damaging.

The natural response to a new regulatory regime is to bolt on a compliance layer: a separate system that captures evidence after the fact, generates reports on a schedule, and sits beside the systems where investment work actually happens. This is how funds responded to AIFMD I, to SFDR, and to early MiFID II obligations. It will not work for the AI Act.

The reason is structural. The Act regulates how decisions are made, not just how they are reported. Article 14's human-oversight requirement, Article 15's accuracy and robustness obligations, and the post-market monitoring regime under Article 72 all require evidence that is generated in the moment a decision is taken, not reconstructed afterwards. A bolt-on compliance layer cannot generate evidence it never observed.

The architectural response is to make decision provenance a native property of the workflow itself. Every screening, every diligence output, every IC discussion, every portfolio review, and every AI-assisted analysis is captured in a single, structured layer at the moment it occurs. Compliance documentation, LP-facing disclosure and regulatory submissions become byproducts of that record rather than separate exercises.

This is the same architectural argument we made in The Fragmented Fund regarding operational efficiency, applied now to regulatory durability. The funds that consolidate their operating stack ahead of the 2026 enforcement cycle will face the new regime with their evidence already in place. The funds that do not will face it carrying the additional weight of reconstruction.